Introduction

What you can build

The VUZ Developer API lets your own VUZ business — a store, a plugin, a custom integration — issue Israeli tax-compliant documents, manage clients, and get notified of events, entirely over REST:

• Documents — create tax invoices / receipts / quotes / credit notes, finalize them (sequential number, signed PDF, Tax Authority allocation where required), cancel, share by email/SMS/WhatsApp, and preview PDFs — with VAT computed per Israeli tax rules
• Clients & CRM — the customers you bill, plus pipelines, deals, tasks, meetings, and call logs
• Catalog & inventory — full product CRUD, warehouses, stock movements, and counts
• Expenses — create expenses, run OCR on receipts, approve, and export
• Money — payment links, standing orders (mandates), payment terms, customer ledger
• Reports — trial balance, P&L, balance sheet, VAT reports, uniform export (מבנה אחיד)
• Webhooks — subscribe to document.finalized, payment.received, and 7 other events with HMAC-SHA256-signed deliveries

One API, two credentials

There is no separate "public API" namespace — the endpoints above are the same /api/v1/* routes the VUZ dashboard itself calls. Every route that accepts a credential is explicitly opted in — today that's 439 operations across 62 resource groups, each gated by scopes. Two credential types work interchangeably on all of them:

• API key (X-Api-Key header) — the simplest path for a developer; create one from Settings → Integrations → API Keys in your VUZ dashboard. See Auth → API keys.
• OAuth 2.0 bearer token (Authorization: Bearer vuz_at_*) — for a store plugin (e.g. WooCommerce) that connects your VUZ business without you ever sharing a raw secret. See Auth → OAuth.

Both credential types carry scopes, are rate-limited, and are bound to exactly one business — the credential itself determines which business's data you can touch; you never send a business ID. See Choosing a credential for the full comparison.

What this is NOT

• Not a new endpoint namespace. There is no /api/v1/public/*. Public-API-accessible routes are ordinary dashboard endpoints explicitly opted in to accept a token.
• Not unscoped. The surface is broad (439 operations), but every credential is bound to exactly one business and limited to its granted scopes — a documents:read key cannot touch expenses, the ledger, or anything else.
• Not a payment processor. VUZ documents a transaction; you (or your existing payment provider) collect the money.

Environments

Next steps